On the eve of the IPcalypse

As you might have heard, the IPcalypse is nigh. Okay, maybe you haven’t heard. The IPcalypse refers to the sale of the last IPv4 addresses on the open market. We’re projected to run out within the next few days. How will this affect you?

Odds are it won’t. Not in the short term, at any rate. Imagine if the post office announced that they’d run out of street addresses. All of the existing houses would be fine, and still be able to receive mail. New houses wouldn’t get addresses, though, and would be unable to send or receive mail. Running out of IPv4 addresses is like that.

Of course, it’s somewhat more complicated. Whereas you can still build a house without a postal address, still live there, still have people come over – well, imagine if you need an address to access the road. Without an IP address, a computer is cut off from the internet. It can neither send nor receive data; it’s just a standalone device.

But there remain options. Plenty of them, in fact.

For one thing, the sale of the last IPv4 addresses doesn’t mean that there are no addresses to be had. There are still significant swathes of unused IP addresses, mostly in the hands of universities which got some of the original /8 (Class A) network blocks but have no need for the staggering 16 million addresses available to them. Thanks to Classless InterDomain Routing, these blocks can be broken into smaller segments. Now is probably a very good time for such organizations to auction off segments of these address blocks – they’ll fetch a very high price now, but their value will drop rapidly. But for right now, there do remain IP addresses to be had, if the price is right.

Another way to squeeze out even more life from IPv4 is to use Network Address Translation (NAT). NAT allows a computer to be assigned a “local” IP address, and multiple computers with local addresses use a single computer with a public address to talk to the wider world. If IP addresses are like postal addresses, then NAT lets you put people in apartment buildings instead of houses. This means that fewer computers need a public IP address, and as with CIDR, this may open up more addresses.

Both of these methods should be familiar: they’ve been in use for the last decade, keeping IPv4 viable. Which, for good or ill, means even these options are mostly exhausted. The simple fact is, we’re running out of addresses, and we can only avoid that fact for so long.

This means we need to migrate to IPv6. I have some misgivings about IPv6, to be sure, but we definitely need to take that plunge. There simply aren’t any other long-term options on the table; CIDR and NAT are just rearguard actions.

So what’s going to happen?

As should be obvious to anyone who knows corporate America, a large number of companies are going to put off the conversion for as long as possible. This won’t last long, but there’s going to be a big opportunity for people who know IPv6 then. But no few companies will see, or have already seen, the writing on the wall and are making the conversion. This means that some ISPs will be using both IPv6 and IPv4. Others will still be on IPv4 only, and new hosts will use IPv6 only. Problem is, IPv6 addresses aren’t backwards-compatible with IPv4 addresses: there’s no guarantee that hosts on IPv4 will be able to talk to hosts on IPv6, nor vice-versa. There are, of course, workarounds for this. In some cases they will be implemented well, and the transition will be seamless. In other cases, not so much. This means that in the coming year we can expect to see network fragmentation. Unfortunately, there’s relatively little that most organizations other than network and internet service providers can do about that; either it’s being implemented properly, or it isn’t.

What can a typical organization do?

First of all, find out about your ISP’s IPv6 offering. The sooner you’re on IPv6 the better off you are, and the less money you’ll spend on IPv4 technology, acquiring new IPv4 addresses, and the inevitable last-minute IPv6 transition. Also, it seems likely that just as it was with IPv4 there will probably be some significant benefits to being an early adopter to IPv6.

Second, make sure your equipment talks in IPv6. Now is definitely the time to apply those firmware updates and set up the IPv6 stacks your network engineers have had on the back burner. Even if your equipment is supposed to have IPv6 support, get updates anyway – beyond the obvious value in frequent updating, it’s likely that older IPv6 implementations will be rather buggy, and some issues may not become apparent until IPv6 becomes more prevalent – so keep your ear to the ground for that, and especially keep up with your vendor notices.

But! You absolutely must do one last thing: check your IPv6 security. Several companies have already been burned, finding out that while their IPv4 traffic is carefully routed, monitored, and scanned, their IPv6 traffic had no controls. Check your policies, check your gateways, check your routers, and check your firewalls. Make sure that when you do start using IPv6 you use it securely.

Unless you work for a network or internet service provider, there’s only so much you can do about the IPcalypse. But you can be ready for the IPv6 transition, and you really should be. We’ve seen this day coming for years now.